awaitCode

Waits for the redirect and returns the authorization code after checking expectedState (CSRF). Answers the browser with a small page telling the user to return to the app. Requests to other paths (a favicon, a probe) are answered 404 and ignored.